Network traffic is often regulated in that not all traffic is allowed access through a network. Much depends on the network infrastructure and its security settings and tools for controlling access. Traffic in networked computer systems is often controlled by firewalls that intercept Internet or other network communications to prevent intrusion of those communications that are unwanted.
At the same time, there are communications that are seemingly legitimate and authorized to access the network through the firewall but are otherwise improper. Communications are defined as being improper if they defy certain rules or create an irregularity or risk to the organization. One example of improper communications between an end-user (client) and a host involve access for the purpose of obtaining private or privileged information in contravention of the organization's usual operating procedures. Another example of improper communication between the client and host is a security breach, where an un-privileged user (e.g., employee) gains access and makes unauthorized changes to company records. Then again, a legitimate and proper communication may nevertheless be of interest and therefore targeted for analysis and reporting. Such legitimate communications may include information relevant to the operations of an organization somewhere remote or enterprise-wide.
Hence, in order to track these improper or targeted communications, a system configuration in needed which monitors and reports traffic. This is somewhat akin to but not entirely similar a firewall.
One approach to tracking and detecting improper or targeted network communications, involves a system for real time monitoring of end-user and administrator communications and communication patterns (collectively “activity”) using configurable business rules for detecting exceptions that indicate such activities. This system tracks all users in the mainframe server environments, e.g., iSeries systems, IBM 5250 or 3270 mainframes or AS/400 mid-range system environments or other client-server based systems such as ERP (enterprise resource planning) and packaged applications. This approach non-invasively tracks and records all user activity in legacy applications while creating a log or field-level audit trail of activity, where recorded data (activity log) is ciphered and digitally signed, thus being court-admissible. The system monitors any type of activity regardless of the host's operating system (OS/390, VSE, VM, OS/400, etc.) and the database used by the applications is transparent (including DB2, IMS, ADABAS, VSAM, etc.). The system runs on a separate server which intercepts communications between end-users and hosts by sniffing network transmissions through a network switch. The real time sniffing of transmission through a network switch creates an activity log that can be later accessed to retrieve evidence of improper, irregular, risky or simply targeted communications.